Contents

Well-known numbers

Default UDP port

25826

Default IPv4 Multicast group

239.192.74.66

Default IPv6 multicast group

ff18::efc0:4a42

Maximum packet size

1452 bytes (payload only, not including UDP / IP headers)In versions 4.0 through 4.7, the receive buffer had a fixed size of 1024 bytes. When longer packets are received, the trailing data is simply ignored. Since version 4.8, the buffer size can be configured.

Protocol structure

Beginning of each “part”: Type and length.

Each packet consists of one or more so called “parts”. Each part starts with the same four bytes: Two bytes that specify the “part type” (what kind of information is enclosed in the part) and two bytes which specify the length of the part, including the four header bytes itself. Both type and length should be encoded in network order, aka Big Endian. The maximum length of payload in any part is therefore 65531 bytes.

Using this layout, clients can determine the length of a part they don't know and lets them skip unknown data. This makes the protocol forward compatible so that new features can be added easily.

Protocol allows signature verification and encryption. This is done using corresponding “parts”.

There are two part layouts that are used for a couple of “types”: numeric (an 8 byte integer) and string.

Numeric parts

Structure of the “number” parts

Numeric integer values, e. g. the interval and time values, are transferred using 8 byte integers. The length field of those parts must therefore always be set to 12.

String parts

Structure of “string” parts. The example shows the encoding of the string “foobar”.

Strings are transferred including a null byte at the end. In the example you can see the encoding of the string “foobar”. The string is six characters long, followed by a null-byte and appended to a four byte header, leading to a length of 11 bytes for this part.

Value parts

Value parts encode an actual data sample. Preceding time, plugin, plugin instance, type, and type instance parts must have set the context for the data sample. The value part consists of:

Many data samples have a single value, such as "cpu" (see types.db(5)), but others have multiple values, such as "disk_merged", which has read and write values.

In case you have many values, the types need to be defined first, then the values, like this: [type][type][type][value][value][value] and not [type][value][type][value][type][value].

Signature part

Signature part prepends signed parts of the packet. Each signed packet should have its own signature part at top of parts.

The signature part consists of fields:

Type 0x0200

Length (16 bit field)

Hash (32 bytes fixed length string)

Username (without null byte)

Unlike `String parts`, Username value does not contain a null byte at the end.

The Length specifies the full length of the Signature part.
Unlike Encrypted part, Length does not contain length of signed content, so Username field length can be calculated as Length - 36 (2 bytes of Type field + 2 bytes of Length field + 32 bytes of Hash field).

Hash value is calculated for Username field + signed parts content.

Encrypted part

Encrypted part is container, it contains other parts in encrypted form.

The encrypted part consists of fields:

Type 0x0210

Length (16 bit field)

Username length (16 bit field, length of Username field)

Username (without null byte)

Init vector (16 bytes fixed length)

Hash (20 bytes fixed length)

Encrypted data

Unlike `String parts`, Username value does not contain a null byte at the end.

The Length specifies the full length of the Encrypted part including 'Encrypted data' length.

Part types

The following numeric types are currently used to identify the type of a “part”. Defines are available from src/network.h.

ID

Name

Data type

Comment

0x0000

Host

String

The name of the host to associate with subsequent data values

0x0001

Time

Numeric

The timestamp to associate with subsequent data values, unix time format (seconds since epoch)